"Am I still working okay?" asked the micro controller...

The main purpose of redundant systems is to let the system operate normally even if some controllers fail, not safety. I fully agree that the last ditch security system should not rely on computer logic and preferably not even on electricity.

Paul

But how does the WDT tell the difference between a transient failure and the hardware falling apart ?

The self test routines after reset may detect some permanent failure or it might not. The self test routine itself could go crazy due to permanent hardware problems and the WDT kicks in again.

Now we have an other interesting situation, which has not been discussed so far. If there is a permanent hardware/software error and the WDT triggers over and over again, this can also cause a lot of damage (e.g. due to repeated large startup currents in some big loads). Thus, the WDT should be allowed to kick in only for a predefined number of times and then disable the whole system until manual intervention.

Paul

I have also noticed a trend for some newer WDOG devices to have quite long timeout options (mins to even hours). This can have merit, as examples given in another thread show the problems with designing too close to a WDOG's poorly defined timebase. Other WDOGs I've seen have a longer FIRST trigger window, to allow more elasticity on POST/Boot modes, until the opeational SW proper starts working.

It would be a good idea to check for annoyance/damage modes, in a continually firing WDOG failure instance.

-jg

As colleague DW said, " ... idiot proof. It proves we're idiots." He was kidding, of course.

Regards. Mel.

"Guy Macon" skrev i meddelandet news:- snipped-for-privacy@speakeasy.net...

Remember reading the warrantly clause like this: "The only guarantee you'll get from us is that eventually all our equipment will fail."

The Artist Formerly Known as Kap'n Salty wrote in news: snipped-for-privacy@corp.supernews.com:

Amen to #4. I remember reading a story about a company that, when hiring salesmen, would always ask the prospective salesman about the major accounts that he had *lost*. If he had never lost a customer, he didn't get hired, because that meant that he had never "played in the major leagues."

Part of being a geek is having a tendency to grossly overestimate the role that personal ability plays in the success of one's work. The reality is that the highest levels of intelligence (or its correlates) that have been observed in human beings are *far, far* away from the levels that would guarentee perfection. Any business process that relies on humans being omniscient is, by definition, a failure. There is *no* way to guarantee that Mr. Murphy will never pay you a visit. There are practices that will make him feel distinctly unwelcome (and there are practices that amount to buying him a first-class plane ticket and putting him up in the penthouse suite of the most expensive hotel in town), but none of them will offer you absolute certainty.

No system can be 100% reliable. All that matters is to get the level of reliability required by the application. Generally, the voter mechanism is designed in order to be far more reliable than the other part of the system (reliability even better than the resulting reliability of the voting algorithm).

Marc